在Spring 4中，有两个方法，hasAuthority()并且hasAnyAuthority()在org.springframework.security.access.expression.SecurityExpressionRoot类中定义。这两种方法仅检查你的自定义角色名称，而不添加ROLE_前缀。定义如下：
public final boolean hasAuthority(String authority) {
return hasAnyAuthority(authority);
}
public final boolean hasAnyAuthority(String... authorities) {
return hasAnyAuthorityName(null, authorities);
}
private boolean hasAnyAuthorityName(String prefix, String... roles) {
Set<String> roleSet = getAuthoritySet();
for (String role : roles) {
String defaultedRole = getRoleWithDefaultPrefix(prefix, role);
if (roleSet.contains(defaultedRole)) {
return true;
}
}
return false;
}
private static String getRoleWithDefaultPrefix(String defaultRolePrefix, String role) {
if (role == null) {
return role;
}
if (defaultRolePrefix == null || defaultRolePrefix.length() == 0) {
return role;
}
if (role.startsWith(defaultRolePrefix)) {
return role;
}
return defaultRolePrefix + role;
}
用法示例：
<http auto-config="false" use-expressions="true" pattern="/user/**"
entry-point-ref="loginUrlAuthenticationEntryPoint">
<!--If we use hasAnyAuthority, we can remove ROLE_ prefix-->
<intercept-url pattern="/user/home/yoneticiler" access="hasAnyAuthority('FULL_ADMIN','ADMIN')"/>
<intercept-url pattern="/user/home/addUser" access="hasAnyAuthority('FULL_ADMIN','ADMIN')"/>
<intercept-url pattern="/user/home/addUserGroup" access="hasAuthority('FULL_ADMIN')"/>
<intercept-url pattern="/user/home/deleteUserGroup" access="hasAuthority('FULL_ADMIN')"/>
<intercept-url pattern="/user/home/**" access="hasAnyAuthority('FULL_ADMIN','ADMIN','EDITOR','NORMAL')"/>
<access-denied-handler error-page="/403"/>
<custom-filter position="FORM_LOGIN_FILTER" ref="customUsernamePasswordAuthenticationFilter"/>
<logout logout-url="/user/logout"
invalidate-session="true"
logout-success-url="/user/index?logout"/>
<!-- enable csrf protection -->
<csrf/>
</http> <beans:bean id="loginUrlAuthenticationEntryPoint"
class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
<beans:constructor-arg value="/user"/>
</beans:bean>
602392714
清零编程群